CVE-2026-84394

fast-uri, the OpenJSF/Fastify URI parsing library, fails to validate hosts that contain an unbalanced or misplaced bracket, so parse() returns the malformed string as the host with no error instead of validating it as an IP literal or canonicalizing it as a domain name. The flaw is triggered whenever an attacker-supplied URL with such a host is parsed: applications that read the parsed host to make a security decision — such as an SSRF denylist, redirect allowlist, or proxy routing rule — and then pass the original URL to Node's URL-based HTTP clients send the request to a different host than the one their policy actually checked. An attacker can exploit this discrepancy to bypass host-based controls and reach internal or otherwise restricted destinations (SSRF) or to slip past redirect and proxy restrictions; the malformed host is also carried through normalize, equal, and resolve. Any Node.js application or library using affected fast-uri versions (2.4.5, 3.1.6, 4.1.3 or earlier in those lines) where the parsed host drives network policy is affected. No public proof-of-concept or in-the-wild exploitation is known: EPSS is low at 0.2% and the issue is not in CISA KEV.

What to do: Upgrade fast-uri to 2.4.6, 3.1.7, or 4.1.4 (matching your installed major version) and rebuild lockfiles; then audit code paths where fast-uri's parse() host output drives SSRF denylists, redirect allowlists, or proxy routing. As an interim mitigation, derive host decisions from the same URL parser the HTTP client uses (Node's URL) or reject hosts containing brackets that are not valid IPv6 literals.